Versioned threat detection for normalized events
Turn normalized telemetry into explainable alerts with safe, testable rules.
01
The operational problem
A detection rule is only useful when analysts understand the data it evaluates and can reproduce why it fired. Ad hoc scripts create operational and security risk, and publishing an untested condition can flood the queue. Rules must stay connected to the dataset and parser version that produced their fields.
02
How Tranzify Watch helps
The detection studio lists current datasets automatically and indicates whether an active parser is available. Analysts build typed conditions with AND and OR groups, comparison operators and RE2 regular expressions, or inspect the equivalent safe JSON DSL. Rules can be tested against historical events before publication. Every revision is retained, disabled rules stop processing new events, and no arbitrary user code is executed in the event pipeline.